PT-2018-16162

CVE-2018-3739

Published

2018-06-07

Updated

2019-10-09

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions https-proxy-agent versions prior to 2.2.0

Description The issue results in a denial of service and an uninitialized memory leak due to unsanitized options being passed to the Buffer() function. This can occur when an attacker submits typed input to the auth parameter, such as in JSON setups.

Recommendations Update to version 2.2.0 or later.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-125: Out-of-bounds Read

CWE-400: Uncontrolled Resource Consumption

Related identifiers

CVE-2018-3739